

I think they’re saying they’ve already signed into a Google account, downloaded play store apps, and set everything up. Afterwards, they have disconnected the Chromecast from the internet and successfully continued to access their self hosted content.
They mention they’re only doing things locally, and looking into using tailscale, so they aren’t exposing to public web and the security concerns you mention are a lot less important.